0

I have a service broker configured in two different databases on two different servers. The problem is that I can't receive message because I have the problem:
Connection handshake failed. The login 'public' does not have CONNECT permission on the endpoint. State 84. I have endpoints with certyficates, I gave permission to connect to a specific user who has a certificate(I did it on two servers because it is always on availability group), while looking for a problem I noticed that the certificate from the initiating server is different from the certificate from the target server:
-initiator - signature algorithm: sha1RSA, key length: 1024 (sql ver. 11.0.7 ...)
-target - signature algorithm: sha256RSA, key length: 2048 (sql ver. 15.0.4 ...)

When I grant permission:
grant connect on endpoint :: BrokerEndPoint to PUBLIC
Servers communicate but this does not solve the problem. Can different types of certificates be a problem?

2 Answers 2

0

grant connect on endpoint :: BrokerEndPoint to PUBLIC

Doing this basically bypasses authorization, as everybody is authorized to connect. I think you should try to fix the user/roles permission.

I noticed that the certificate from the initiating server is different from the certificate from the target server:

This shouldn't make any difference.

It looks like the problem is you somehow misconfigured the users/login/certs chain. Is so darn complicated that is easy to break... Here is a redux of the proper setup:

  • There are two layers of security: conversation security (between services in DBs) and transport security (between endpoints in instances). You are now talking about transport security (endpoint to endpoint).
  • Endpoint security is always between the SQL instances involved. If you have AGs then each node needs to be separately configured, as the endpoints are instance level concepts and do not follow AG failovers.
  • An endpoint will use the certificate configured (CREATE ENDPOINT ... FOR SERVICE_BROKER (AUTHENTICATION = CERTIFICATE <certname>)). The certificate must have an accessible private key to be usable (ie encrypted with a key that can be opened from the service master key, usually via the master database master key).
  • During handshake, the authentication and authorization is mutual. Say to instances, S1 and S2 need to connect, then:
  • S1 will use certificate C1, S2 uses certificate C2
  • S1 needs to have C2 (public key only) in its master database, and S2 needs to have C1 (public key only) in its master.
  • The C2 certificate in S1 master is owned by a database user (a database principal), say it's US2. This user has a login (a server principal, say UL2). The login UL2 must be granted CONNECT permission on the S1 endpoint.
  • Vice-versa: the C1 certificate in S2 master is owned by an user (US1) that has a login (UL1). This login UL1 needs to be granted CONNECT permission on S2 endpoint.

For troubleshooting, enable the "Audit Broker Login" event in Profiles (in the Security Audit group). This event will fire with details of why a handshake fails, when it fails.

0

Ty for your time, I checked the connection and data again and found no problem anywhere. As I was bothered by the fact that maybe it was a problem that I wrote about so for the test I created another connection but this time on the server with SHA256 certificate and as I thought it is a problem here. To confirm my theory, I replaced the certificate on the initial server about which I wrote earlier to SHA256 (I deleted and re-created the endpoint with this certificate) and on the target server I replaced this certificate and the problem was solved. So it's like I thought certificates must have the same type of encoding.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.